feat: wire the latest-chapter poller into startup

Five env vars, all with defaults sized for this deployment (84 series
at a 1h cadence). Bad values log and fall back rather than failing
startup, and the cooldown is floored at 15m. Fetches go through
tls-client with a Chrome profile as defence in depth.

CLAUDE.md

@@ -38,8 +38,25 @@ Bromite userscript (isolated world, per-site adapters, localStorage cache)
   the web routes are not registered at all. UI mutations read-modify-write
   through `Store.Get` + `Store.Upsert` so the `updated_at` rule stays in one
   place. See `docs/superpowers/specs/2026-07-25-web-ui-design.md`.
+- **Latest-chapter poller:** a ticker goroutine in the same binary re-checks
+  each bookmarked series' newest published chapter from the backend's own
+  network access, so `latest_chapter` stays fresh when the user is not
+  browsing. It is a *second, parallel* signal — the userscript keeps its own
+  `maybeCaptureLatestOnSeriesPage`/`backgroundRefreshLatest` logic unchanged.
+  Two independent clocks: a per-bookmark cooldown (`latest_checked_at` column,
+  enforced by `Store.DueForLatestCheck`'s WHERE clause) and a wake interval.
+  The row is stamped *before* the fetch so a broken series waits out a full
+  cooldown instead of retrying every tick, and writes go through
+  `Store.Get` + `Store.Upsert` so a new chapter never reorders the list.
+  Fetches use `bogdanfinn/tls-client` with a Chrome profile as defence in depth
+  against fingerprint-based blocking; any failure logs and skips. See
+  `docs/superpowers/specs/2026-07-26-server-latest-chapter-polling-design.md`.
 - **`updated_at` drives list order, so it moves only on real reading progress:** the server applies its timestamp when the row is new or `last_chapter_num` changes, and otherwise keeps the stored value — favouriting a series or recording a newly published chapter must not reorder the list. `PUT` therefore returns the row **as stored**, and clients must adopt that response rather than their own payload. See `plans/2026-07-25-bookmark-list-favorites-design.md` §4.
-- **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH` (default `/data/bookmarks.db`), `PORT` (default `8080`), `WEB_PASSWORD` (gates the browser UI; unset disables it).
+- **Config via env:** `API_TOKEN`, `ALLOWED_ORIGINS` (comma list), `DB_PATH`
+  (default `/data/bookmarks.db`), `PORT` (default `8080`), `WEB_PASSWORD`
+  (gates the browser UI; unset disables it),
+  `LATEST_CHAPTER_POLL_ENABLED`/`_COOLDOWN`/`_INTERVAL`/`_BATCH`/`_STAGGER`
+  (background latest-chapter poller; defaults on, `1h`/`10m`/`14`/`20s`).
 
 ### Userscript structure (single IIFE, `manga-bookmark.user.js`)